CVE-2026-45943 (GCVE-0-2026-45943)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:17 – Updated: 2026-05-27 12:17
VLAI
Title
erofs: fix inline data read failure for ztailpacking pclusters
Summary
In the Linux kernel, the following vulnerability has been resolved: erofs: fix inline data read failure for ztailpacking pclusters Compressed folios for ztailpacking pclusters must be valid before adding these pclusters to I/O chains. Otherwise, z_erofs_decompress_pcluster() may assume they are already valid and then trigger a NULL pointer dereference. It is somewhat hard to reproduce because the inline data is in the same block as the tail of the compressed indexes, which are usually read just before. However, it may still happen if a fatal signal arrives while read_mapping_folio() is running, as shown below: erofs: (device dm-1): z_erofs_pcluster_begin: failed to get inline data -4 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 ... pc : z_erofs_decompress_queue+0x4c8/0xa14 lr : z_erofs_decompress_queue+0x160/0xa14 sp : ffffffc08b3eb3a0 x29: ffffffc08b3eb570 x28: ffffffc08b3eb418 x27: 0000000000001000 x26: ffffff8086ebdbb8 x25: ffffff8086ebdbb8 x24: 0000000000000001 x23: 0000000000000008 x22: 00000000fffffffb x21: dead000000000700 x20: 00000000000015e7 x19: ffffff808babb400 x18: ffffffc089edc098 x17: 00000000c006287d x16: 00000000c006287d x15: 0000000000000004 x14: ffffff80ba8f8000 x13: 0000000000000004 x12: 00000006589a77c9 x11: 0000000000000015 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000003f x5 : 0000000000000040 x4 : ffffffffffffffe0 x3 : 0000000000000020 x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: z_erofs_decompress_queue+0x4c8/0xa14 z_erofs_runqueue+0x908/0x97c z_erofs_read_folio+0x128/0x228 filemap_read_folio+0x68/0x128 filemap_get_pages+0x44c/0x8b4 filemap_read+0x12c/0x5b8 generic_file_read_iter+0x4c/0x15c do_iter_readv_writev+0x188/0x1e0 vfs_iter_read+0xac/0x1a4 backing_file_read_iter+0x170/0x34c ovl_read_iter+0xf0/0x140 vfs_read+0x28c/0x344 ksys_read+0x80/0xf0 __arm64_sys_read+0x24/0x34 invoke_syscall+0x60/0x114 el0_svc_common+0x88/0xe4 do_el0_svc+0x24/0x30 el0_svc+0x40/0xa8 el0t_64_sync_handler+0x70/0xbc el0t_64_sync+0x1bc/0x1c0 Fix this by reading the inline data before allocating and adding the pclusters to the I/O chains.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: cecf864d3d76d50e3d9c58145e286a0b8c284e92 , < ad07ea069f924465061cfee40ef2861bb99f4dd8 (git)
Affected: cecf864d3d76d50e3d9c58145e286a0b8c284e92 , < 5de1aa0bf3a5db0b3cbf61959da5ac61250833ed (git)
Affected: cecf864d3d76d50e3d9c58145e286a0b8c284e92 , < 92088bd9aa2a7246bba8b9648fbc64edd173cf17 (git)
Affected: cecf864d3d76d50e3d9c58145e286a0b8c284e92 , < c134a40f86efb8d6b5a949ef70e06d5752209be5 (git)
Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.12.78 , ≤ 6.12.* (semver)
Unaffected: 6.18.14 , ≤ 6.18.* (semver)
Unaffected: 6.19.4 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/zdata.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ad07ea069f924465061cfee40ef2861bb99f4dd8",
              "status": "affected",
              "version": "cecf864d3d76d50e3d9c58145e286a0b8c284e92",
              "versionType": "git"
            },
            {
              "lessThan": "5de1aa0bf3a5db0b3cbf61959da5ac61250833ed",
              "status": "affected",
              "version": "cecf864d3d76d50e3d9c58145e286a0b8c284e92",
              "versionType": "git"
            },
            {
              "lessThan": "92088bd9aa2a7246bba8b9648fbc64edd173cf17",
              "status": "affected",
              "version": "cecf864d3d76d50e3d9c58145e286a0b8c284e92",
              "versionType": "git"
            },
            {
              "lessThan": "c134a40f86efb8d6b5a949ef70e06d5752209be5",
              "status": "affected",
              "version": "cecf864d3d76d50e3d9c58145e286a0b8c284e92",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/zdata.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix inline data read failure for ztailpacking pclusters\n\nCompressed folios for ztailpacking pclusters must be valid before adding\nthese pclusters to I/O chains. Otherwise, z_erofs_decompress_pcluster()\nmay assume they are already valid and then trigger a NULL pointer\ndereference.\n\nIt is somewhat hard to reproduce because the inline data is in the same\nblock as the tail of the compressed indexes, which are usually read just\nbefore. However, it may still happen if a fatal signal arrives while\nread_mapping_folio() is running, as shown below:\n\n erofs: (device dm-1): z_erofs_pcluster_begin: failed to get inline data -4\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008\n\n ...\n\n pc : z_erofs_decompress_queue+0x4c8/0xa14\n lr : z_erofs_decompress_queue+0x160/0xa14\n sp : ffffffc08b3eb3a0\n x29: ffffffc08b3eb570 x28: ffffffc08b3eb418 x27: 0000000000001000\n x26: ffffff8086ebdbb8 x25: ffffff8086ebdbb8 x24: 0000000000000001\n x23: 0000000000000008 x22: 00000000fffffffb x21: dead000000000700\n x20: 00000000000015e7 x19: ffffff808babb400 x18: ffffffc089edc098\n x17: 00000000c006287d x16: 00000000c006287d x15: 0000000000000004\n x14: ffffff80ba8f8000 x13: 0000000000000004 x12: 00000006589a77c9\n x11: 0000000000000015 x10: 0000000000000000 x9 : 0000000000000000\n x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000003f\n x5 : 0000000000000040 x4 : ffffffffffffffe0 x3 : 0000000000000020\n x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000\n Call trace:\n  z_erofs_decompress_queue+0x4c8/0xa14\n  z_erofs_runqueue+0x908/0x97c\n  z_erofs_read_folio+0x128/0x228\n  filemap_read_folio+0x68/0x128\n  filemap_get_pages+0x44c/0x8b4\n  filemap_read+0x12c/0x5b8\n  generic_file_read_iter+0x4c/0x15c\n  do_iter_readv_writev+0x188/0x1e0\n  vfs_iter_read+0xac/0x1a4\n  backing_file_read_iter+0x170/0x34c\n  ovl_read_iter+0xf0/0x140\n  vfs_read+0x28c/0x344\n  ksys_read+0x80/0xf0\n  __arm64_sys_read+0x24/0x34\n  invoke_syscall+0x60/0x114\n  el0_svc_common+0x88/0xe4\n  do_el0_svc+0x24/0x30\n  el0_svc+0x40/0xa8\n  el0t_64_sync_handler+0x70/0xbc\n  el0t_64_sync+0x1bc/0x1c0\n\nFix this by reading the inline data before allocating and adding\nthe pclusters to the I/O chains."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T12:17:58.764Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ad07ea069f924465061cfee40ef2861bb99f4dd8"
        },
        {
          "url": "https://git.kernel.org/stable/c/5de1aa0bf3a5db0b3cbf61959da5ac61250833ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/92088bd9aa2a7246bba8b9648fbc64edd173cf17"
        },
        {
          "url": "https://git.kernel.org/stable/c/c134a40f86efb8d6b5a949ef70e06d5752209be5"
        }
      ],
      "title": "erofs: fix inline data read failure for ztailpacking pclusters",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45943",
    "datePublished": "2026-05-27T12:17:58.764Z",
    "dateReserved": "2026-05-13T15:03:33.087Z",
    "dateUpdated": "2026-05-27T12:17:58.764Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45943",
      "date": "2026-08-03",
      "epss": "0.00125",
      "percentile": "0.02608"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:41:26.000Z",
      "cve": "CVE-2026-45943",
      "id": "msrc_CVE-2026-45943",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "erofs: fix inline data read failure for ztailpacking pclusters",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-45943.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-45943\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-27T14:17:10.557\",\"lastModified\":\"2026-06-24T17:09:01.847\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nerofs: fix inline data read failure for ztailpacking pclusters\\n\\nCompressed folios for ztailpacking pclusters must be valid before adding\\nthese pclusters to I/O chains. Otherwise, z_erofs_decompress_pcluster()\\nmay assume they are already valid and then trigger a NULL pointer\\ndereference.\\n\\nIt is somewhat hard to reproduce because the inline data is in the same\\nblock as the tail of the compressed indexes, which are usually read just\\nbefore. However, it may still happen if a fatal signal arrives while\\nread_mapping_folio() is running, as shown below:\\n\\n erofs: (device dm-1): z_erofs_pcluster_begin: failed to get inline data -4\\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008\\n\\n ...\\n\\n pc : z_erofs_decompress_queue+0x4c8/0xa14\\n lr : z_erofs_decompress_queue+0x160/0xa14\\n sp : ffffffc08b3eb3a0\\n x29: ffffffc08b3eb570 x28: ffffffc08b3eb418 x27: 0000000000001000\\n x26: ffffff8086ebdbb8 x25: ffffff8086ebdbb8 x24: 0000000000000001\\n x23: 0000000000000008 x22: 00000000fffffffb x21: dead000000000700\\n x20: 00000000000015e7 x19: ffffff808babb400 x18: ffffffc089edc098\\n x17: 00000000c006287d x16: 00000000c006287d x15: 0000000000000004\\n x14: ffffff80ba8f8000 x13: 0000000000000004 x12: 00000006589a77c9\\n x11: 0000000000000015 x10: 0000000000000000 x9 : 0000000000000000\\n x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000003f\\n x5 : 0000000000000040 x4 : ffffffffffffffe0 x3 : 0000000000000020\\n x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000\\n Call trace:\\n  z_erofs_decompress_queue+0x4c8/0xa14\\n  z_erofs_runqueue+0x908/0x97c\\n  z_erofs_read_folio+0x128/0x228\\n  filemap_read_folio+0x68/0x128\\n  filemap_get_pages+0x44c/0x8b4\\n  filemap_read+0x12c/0x5b8\\n  generic_file_read_iter+0x4c/0x15c\\n  do_iter_readv_writev+0x188/0x1e0\\n  vfs_iter_read+0xac/0x1a4\\n  backing_file_read_iter+0x170/0x34c\\n  ovl_read_iter+0xf0/0x140\\n  vfs_read+0x28c/0x344\\n  ksys_read+0x80/0xf0\\n  __arm64_sys_read+0x24/0x34\\n  invoke_syscall+0x60/0x114\\n  el0_svc_common+0x88/0xe4\\n  do_el0_svc+0x24/0x30\\n  el0_svc+0x40/0xa8\\n  el0t_64_sync_handler+0x70/0xbc\\n  el0t_64_sync+0x1bc/0x1c0\\n\\nFix this by reading the inline data before allocating and adding\\nthe pclusters to the I/O chains.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/erofs/zdata.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"cecf864d3d76d50e3d9c58145e286a0b8c284e92\",\"lessThan\":\"ad07ea069f924465061cfee40ef2861bb99f4dd8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cecf864d3d76d50e3d9c58145e286a0b8c284e92\",\"lessThan\":\"5de1aa0bf3a5db0b3cbf61959da5ac61250833ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cecf864d3d76d50e3d9c58145e286a0b8c284e92\",\"lessThan\":\"92088bd9aa2a7246bba8b9648fbc64edd173cf17\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cecf864d3d76d50e3d9c58145e286a0b8c284e92\",\"lessThan\":\"c134a40f86efb8d6b5a949ef70e06d5752209be5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/erofs/zdata.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.78\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.14\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.4\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"6.12.78\",\"matchCriteriaId\":\"D63EA9D8-C006-4E77-BDF1-A16D81078A10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.14\",\"matchCriteriaId\":\"BF463CB7-1F58-4607-B847-77ED23E4B9B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.4\",\"matchCriteriaId\":\"672A3E79-EC03-479D-8503-361DFBDC8092\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5de1aa0bf3a5db0b3cbf61959da5ac61250833ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/92088bd9aa2a7246bba8b9648fbc64edd173cf17\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ad07ea069f924465061cfee40ef2861bb99f4dd8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c134a40f86efb8d6b5a949ef70e06d5752209be5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-27T16:19:58+00:00",
      "cve": "CVE-2026-45943",
      "id": "CVE-2026-45943",
      "initial_release_date": "2026-05-27T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: erofs: fix inline data read failure for ztailpacking pclusters",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45943.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-05-30T02:03:54Z",
      "cve": "CVE-2026-45943",
      "id": "CVE-2026-45943",
      "initial_release_date": "2026-05-28T03:55:43Z",
      "product_status:known_affected": "102",
      "product_status:known_not_affected": "125",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-45943",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-45943.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.